Case files
Real engagements. Real numbers.
Every case is anonymized from an actual investigation worked by the principal. The headline figures are real; the identifying details are not.
MDR · account takeover · remediation
The sessions were revoked. The password wasn't.
BEC · persistence · M365
706 attacks. Five months. Two mailboxes.
SIEM gap · dwell time
One year of dwell. 91 alerts. Nobody looked.
AiTM · conditional access
Eighteen seconds between two continents.
Legacy protocol · BEC · M365
MFA was on. The attacker used SMTP.
Identity · privileged access · M365
The ghost admin: seven roles, zero MFA.
BEC · email · M365
Five inbox-rule patterns we see every week.
MSSP · SOC · detection engineering
The MSSP added a step. They didn't remove one.
OAuth · tenant hygiene · M365
Five OAuth grants nobody remembers.
Malware · PowerShell · DFIR
JustAskJacky, deobfuscated.
Malvertising · consumer threat intel
86 paid ads. 90 days. One family member.
PUP · malvertising · consumer